Method and system for relay attack prevention

ABSTRACT

A method and system for detecting if a relay is present in a PEPS system for a vehicle is disclosed which includes (a) transmitting a challenge signal including an LF telegram and CW signals from one or more antennas associated with a vehicle to a key fob, the CW signals being measured by the key fob; (b) determining if the CW signals measured by the key fob meet one or more criteria based on the predetermined differences in the magnetic field distribution between: (i) the magnetic field strength values associated with one or more antennas on the vehicle within the PEPS operating regions; and (ii) the magnetic field strength values associated with one or more antennas on the vehicle at the relay transmitter location when a relay is present.

FIELD OF THE INVENTION

The present invention relates to passive entry passive start (PEPS)systems and in particular, detection and/or prevention of relay attackson PEPS systems in vehicles used to enter and/or start the vehicle.

BACKGROUND INFORMATION

PEPS systems allow authorized users (with a valid key fob) tolock/unlock and start their vehicle without having to interact with theremote control (i.e. authorized key fob). The PEPS system may unlock orstart the vehicle via a manually triggered input request (capacitivesensor, push button, etc.) if the key fob is determined to be in a validPEPS region.

A PEPS system may define operating regions such that if an authorizedkey fob is located within the correct operating region then the vehiclewill respond to lock/unlock and start requests. PEPS regions can bedefined by using low frequency (LF) signal fields emitted from antennason the vehicle. A received signal strength indicator (RSSI) is typicallyimplemented in the authorized key fob as an abstraction of the magneticfield strength. The PEPS system may define the external operatingregions and internal operating regions using the RSSI signal levels fromthe various antennas on the vehicle. If an authorized key fob is locatedwithin the correct regions, i.e., the RSSI levels correspond to adefined region then the vehicle will respond to lock/unlock and startrequests.

A problem associated with PEPS systems is that vehicle thieves mayutilize what is known as a “relay attack” to steal the vehicle. Therelay attack tricks the PEPS system into believing that the thief is anauthorized user (in a defined inclusion region).

A relay attack generally requires two thieves (“Thief A” and “Thief B”)together with the authorized user (i.e., vehicle owner or otherpossessor of the key fob) being in the same vicinity. A relay attackinvolves extending the range of the LF field so that an authorized keyfob which is not in proximity of the vehicle will receive the LFchallenge signal. “Thief A” carries a relay receiver (to receive the LFsignal) and is located close to the vehicle while “Thief B” carries therelay transmitter (to re-transmit the LF signal) and is located in closeproximity to the authorized key fob. In an “analog relay”, the relayreceiver receives the LF signal then up-converts the frequency to aradio frequency (RF) and transmits it over an RF link to the relaytransmitter. The relay transmitter receives the RF signal and thendown-converts the RF signal to LF and re-transmits the LF signal to anauthorized key fob. Analog relays are independent of the modulation andencoding of the LF signal. Other relay configurations are possible, forexample, a “digital relay” where the relay receiver demodulates the LFsignal and then the data stream is modulated over RF and transmitted.The relay transmitter demodulates the RF signal and then the data streamis modulated over LF and re-transmitted.

A key fob automatically transmits an RF response upon receiving the LFchallenge. The RF response signal will typically transmit betweenapproximately 20-200 m back to the vehicle. If the vehicle receives thisresponse then it will assume that the key fob is in the vicinity of thevehicle and so the request will be authenticated. In addition, the relayattack method may also be applied to extend the range of the RF responserange beyond the transmit range of the key fob.

In summary, in a relay attack, thieves are able to enter and start avehicle when the key fob is outside its normal operating regions byrelaying messages from one location to another to make the vehicleappear closer to the key fob.

Techniques exist which aim to prevent relay attack by analysis of thePEPS LF and UHF signals, for example, measuring the time of flight,signal vector checks and/or signal superposition, etc. These techniquesare generally complicated, ineffective or expensive.

Patent document US2011/0148573A1 discusses a passive entry system whichutilizes measurements of RSSI levels to establish an authorizationregion based upon the geometrical shape of the signal radiated from anantenna. However, this approach is only intended to detect anauthentication region and will not detect whether a relay is in use soit will not prevent a relay attack from being successful.

Before turning to a summary of the present invention, it will beappreciated that the discussion of the background to the invention isincluded to explain the context of the invention. This is not to betaken as an admission that any of the material referred to is published,known or part of the common general knowledge.

SUMMARY OF THE INVENTION

According to a first aspect, the present invention provides, a method ofdetecting if a relay is present in a PEPS system for a vehicle includingthe steps of: (a) transmitting a challenge signal including an LFtelegram and CW signals from one or more antennas associated with avehicle to a key fob, the CW signals being measured by the key fob; (b)determining if the CW signals measured by the key fob meet one or morecriteria based on the predetermined differences in the magnetic fielddistribution between: (i) the magnetic field strength values associatedwith one or more antennas on the vehicle within the PEPS operatingregions; and (ii) the magnetic field strength values associated with oneor more antennas on the vehicle at the relay transmitter location when arelay is present.

In addition to relay attack detection, the method of aspect one can bealtered to differentiate between a relay attack and an LF noise sourcein close proximity to the key fob. An LF noise source, may be forexample, an electronic device such as a mobile phone may alter themagnetic field distribution generated by the vehicle antennas. When thekey fob is in close proximity to an electronic device, the LF noise fromthe device may cause the key fob to falsely detect a relay, i.e., the LFnoise causes enough change to the magnetic field distribution and causesone or more of the predetermined relay detection criteria to incorrectlydetect a relay. Advantageously, the present invention can be used todifferentiate between a relay attack and an LF noise source in closeproximity to the key fob, for example, an electronic device such as amobile phone.

According to a second aspect, the present invention provides, a methodof detecting if an LF noise source is present in a PEPS system for avehicle including the steps of: (a) transmitting a challenge signalincluding an LF telegram and CW signals from one or more antennasassociated with a vehicle to a key fob, the CW signals being measured bythe key fob; (b) determining if the CW signals measured by the key fobmeet one or more criteria based on the predetermined differences in themagnetic field distribution between: (i) the magnetic field strengthvalues associated with one or more antennas on the vehicle within thePEPS operating regions; and (ii) the magnetic field strength valuesassociated with one or more antennas on the vehicle within the PEPSoperating regions when an LF noise source is present. In addition, themagnetic field strength values associated with one or more antennas onthe vehicle at the relay transmitter location when a relay is presentmay be used to refine the criteria.

The criteria may be developed for each PEPS operating regionindividually, for example the driver door side operating region, thepassenger door side operating region, etc.

The challenge signal may be transmitted as a low frequency LF signal.

The challenge signal may contain a data telegram and CW signals from oneor more of the vehicle antennas transmitted sequentially.

The magnetic field strength may be represented by an RSSI measurementlevel of the transmitted CW signals.

The present invention exploits the fact that it is extremely difficultfor a relay to reproduce the magnetic field distribution that occurs atthe vehicle, i.e., to develop a perfect relay. If a non-perfect relay isused the magnetic field distribution at the vehicle is typicallydifferent from the field distribution generated by the relay.Advantageously, the present invention utilizes the LF CW (continuouswave) signal levels from different vehicle antennas to determine aseries of conditions that determine whether a relay is in use.

The one or more criteria may include one or more conditional statements.

The vehicle may include antennas which are mounted in more than twoorientations in relation to each other. The orientations may include oneor more of parallel, orthogonal, or any other angle to each other.

According to a third aspect, the present invention provides, a systemfor detecting if a relay is present in a PEPS system for a vehicleincluding: one or more antennas associated with the vehicle fortransmitting a challenge signal from the one or more antennas to a keyfob; one or more controllers configured to: (a) transmit the challengesignal including an LF telegram and CW signals from one or more antennasassociated with a vehicle to a key fob, the CW signals being measured bythe key fob; (b) determine if the CW signals measured by the key fobmeet one or more criteria based on the predetermined differences in themagnetic field distribution between: (i) the magnetic field strengthvalues associated with one or more antennas on the vehicle within thePEPS operating regions; and (ii) the magnetic field strength valuesassociated with one or more antennas on the vehicle at the relaytransmitter location when a relay is present.

According to a fourth aspect, the present invention provides, a systemfor detecting if an LF noise source is present in a PEPS system for avehicle including: one or more antennas associated with the vehicle fortransmitting a challenge signal from the one or more antennas to a keyfob, the CW signals being measured by the key fob; one or morecontrollers configured to: (a) transmit the challenge signal includingan LF telegram and CW signals from one or more antennas associated witha vehicle to a key fob; (b) determine if the CW signals measured by thekey fob meet one or more criteria based on the predetermined differencesin the magnetic field distribution between: (i) the magnetic fieldstrength values associated with one or more antennas on the vehiclewithin the PEPS operating regions; and (ii) the magnetic field strengthvalues associated with one or more antennas on the vehicle within thePEPS operating regions when an LF noise source is present. In addition,the magnetic field strength values associated with one or more antennason the vehicle at the relay transmitter location when a relay is presentmay be used to refine the criteria.

According to a fifth aspect, the present invention provides, a method ofobtaining data sets and establishing criteria for use in detecting if arelay is present in a PEPS system for a vehicle including the steps of:(a) transmitting a challenge signal including an LF telegram and CWsignals from one or more antennas associated with a vehicle to a key fobwithin a PEPS operating region; (b) measuring the magnetic fieldstrength values associated with the challenge signal from a plurality oflocations within a PEPS operating region and storing the results as afirst data set; (c) inserting a relay between the vehicle and the keyfob; (d) transmitting a challenge signal including an LF telegram and CWsignals from one or more antennas associated with a vehicle to a key fobat the relay transmitter when a relay is in place; (e) measuring themagnetic field strength values associated with the challenge signal froma plurality of locations at the relay transmitter and storing theresults as a second data set; (f) comparing the first and second datasets; and (g) generating one or more criteria based on the comparison ofthe two data sets. This process may be repeated for every separate PEPSoperating region, for example, the driver door side operating region,the passenger door side operating region, etc.

It will be appreciated that different relays can be used between thevehicle and the key fob to generate the second data set. For example,the second data set may include data obtained when a particular relaywas used between the vehicle and the key fob and also include the dataobtained when other relay topologies were used between the vehicle andthe key fob.

According to a sixth aspect, the present invention provides, a method ofobtaining data sets and establishing criteria for use in detecting if anLF noise source is present in a PEPS system for a vehicle including thesteps of: (a) transmitting a challenge signal including an LF telegramand CW signals from one or more antennas associated with a vehicle to akey fob within a PEPS operating region; (b) measuring the magnetic fieldstrength values associated with the challenge signal from a plurality oflocations within a PEPS operating region and storing the results as afirst data set; (c) inserting an LF noise source in proximity to the keyfob within a PEPS operating region; (d) transmitting a challenge signalincluding an LF telegram and CW signals from one or more antennasassociated with a vehicle to a key fob within a PEPS operating regionwhere an LF noise source is in close proximity to the key fob; (e)measuring the magnetic field strength values associated with thechallenge signal from a plurality of locations within a PEPS operatingregion where an LF noise source is in close proximity to the key fob andstoring the results as a second data set; (f) comparing the first andsecond data sets; and (g) generating one or more criteria based on thecomparison of the two data sets. This process may be repeated for everyseparate PEPS operating region, for example, the driver door sideoperating region, the passenger door side operating region, etc. Inaddition, the data set obtained by measuring the magnetic field strengthvalues associated with the challenge signal from a plurality oflocations at the relay transmitter may also be used to refine thecriteria.

It will be appreciated that different LF noise sources can be used togenerate the second data set.

It will be appreciated that a controller can be located in the vehicleonly or in both the vehicle and key fob.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram illustrating a vehicle PEPS system.

FIG. 2 is a schematic diagram illustrating a relay attack on a vehiclehaving a PEPS system.

FIG. 3 is a schematic diagram illustrating a relay attack on a vehiclehaving a PEPS system where the relays have two antennas mountedorthogonally to each other.

FIG. 4 is a flow diagram illustrating the method of the presentinvention to in preventing a relay attack on a vehicle having a PEPSsystem.

FIG. 5 is a flow diagram illustrating the method of the presentinvention to obtain data sets for use with the system and method of thepresent invention.

DETAILED DESCRIPTION

FIG. 1 is a schematic diagram illustrating a vehicle PEPS system 100.The PEPS system 100 allows a vehicle owner (or possessor of the key fob)to lock/unlock and start a vehicle 105 without having to interact withthe key fob 110. Typical PEPS systems define external operating regionsand internal operating regions. If a key fob 110 is located within anoperating region then the vehicle 105 will respond to lock/unlock andstart requests.

The PEPS operating regions may be defined by low frequency (LF) signalmagnetic fields emitted from antennas on the vehicle. Received signalstrength indicator (RSSI) can be utilized in the key fob and the PEPSsystem may define the external operating regions and internal operatingregions using the RSSI signal levels measured from the various antennason the vehicle 105. Then, if a key fob 110 is located within the correctregions (i.e., the RSSI levels correspond to a defined operating region)then the vehicle 105 will respond to the lock/unlock and start request.

PEPS systems may be configured to have manually triggered unlock andstart requests (such as a capacitive sensor, push button and the likeprovided for example, in the handle of the vehicle, or in the vehicleStart/Stop button 105) to transmit the LF challenge signal 115 to thekey fob 110. As part of the LF challenge signal 115, signals aretransmitted from several (or all) of the vehicle antennas. If a key fob110 is located within the expected operating regions (based on the RSSIvalues measured from the vehicle antennas), after receiving the LFchallenge signal 115 it will transmit an authentication response signalon a radio frequency (RF) 120 for the request to be processed in thevehicle. It will be appreciated that bi-directional RF communication mayalso be used.

Some PEPS systems also provide permanent periodically transmitted LFchallenge signals 115 prior to the manually triggered unlock request.For these systems, the vehicle knows when the key fob 110 is in thevicinity of the vehicle before an unlock request is made. The advantageof this is that it can improve system response times and provideadditional features such as comfort lighting as the owner approaches thevehicle 105.

As shown in the FIG. 2, the PEPS system 200 is vulnerable to theft dueto what is known as “relay attack”. The present invention attempts toprevent a relay attack from being successful. In FIG. 2, the relayattack involves extending the range of the LF field (shown in FIG. 1) sothat a key fob 110 which is not in proximity of the vehicle 105 willreceive the LF challenge signal. The relay attack requires two thieves,Thief A and Thief B where Thief A carries a relay receiver (Relay RX)125 and is located close to the vehicle 105 while Thief B carries arelay transmitter (Relay TX) 130 and is located close to the key fob110.

Relay RX 125 receives an LF signal from vehicle 105 and then up-convertsthe frequency to an RF frequency and transmits it via RF link to RelayTX 130. Relay TX 130 receives the RF signal and then down-converts thefrequency to LF and re-transmits the LF signal to the key fob 110. Thisscenario describes the previously defined “analog relay”, however, othertypes of relays could be used. The key fob 110 automatically transmitsan RF response upon receiving the LF challenge. The RF response signalwill typically transmit between approximately 20-200 m back to thevehicle 105. If the vehicle 105 receives this response it will assumethat the key fob 110 is in the vicinity of the vehicle 105 and so therequest will be authenticated. In addition, the relay attack method mayalso be applied to extend the range of the RF response range beyond thetransmit range of the key fob 110.

The relay attack shown in FIG. 2 is a simplified version of a relayattack known as a one dimensional relay attack. However, in operation asshown in FIG. 3, a vehicle 105 has several antennas in the vehicle 105typically mounted in two orientations in relation to each other i.e.parallel or orthogonal to each other, known as a two dimensional relayattack. As shown in FIG. 3, typical antenna orientations for a vehicle105 may be for example antenna 105 a, 105 b parallel to each other andlocated in the door handles while antenna 105 c, 105 d are parallel toeach other and are located in the cabin and trunk of the vehiclerespectively (although it will be appreciated that there may be moresets of antennas provided). For a vehicle such as this a relay needs twoantennas mounted orthogonally to each other in order to effectivelycouple energy from the vehicle antennas into the relay RX for bothvehicle antenna orientations and for the relay TX to attempt toeffectively reproduce the LF field distribution at the vehicle. Inpractice, a more sophisticated relay attack will involve a relayreceiver 125 having antennas 125 a and 125 b and relay transmitter 130having antennas 130 a and 130 b to replicate the antenna orientations inthe vehicle 105.

In practice, it is extremely difficult for a relay 125 and 130 toreproduce the magnetic field distribution that occurs at the vehicle105, that is to say it is very difficult to develop a perfect relay. Thepresent invention constructs a relay and compares RSSI results from therelay to that obtained at the vehicle when no relay is in operation. Thepresent invention utilizes an LF challenge consisting of a data telegramand CW signal levels transmitted sequentially from the different vehicleantennas 105 a, 105 b, 105 c, 105 d to determine a series of conditionsthat determine whether a relay (typically non-perfect relay) is in use.

In the present invention, RSSI levels of each of the CW signals from thevehicle antennas 105 a, 105 b, 105 c and 105 d can be measured by thekey fob 110 and the RSSI data included in the RF response signal fromthe key fob 110. This data can be stored and collected by a controllerassociated with the system and vehicle 105. The controller may take anysuitable form and may for example control operation of the antennas andthe PEPS system that communicates with the key fob 110 can be utilizedby a computer running an application software program. The controllermay be configured to store data relating to the RF responses and may befurther configured to open/lock the doors and or start the vehicle 105and the like.

The key fob may be placed at many positions within the entry or startregions and RSSI levels and data are stored for each position measured.Essentially, this builds up a data set of RSSI levels of the key fob 110in different positions.

As noted above, a relay attack involves extending the range of thevehicle LF field so that a key fob 110 which is not in proximity of thevehicle will receive the LF challenge signal. Since the vehicle 105 hasseveral antennas 105 a, 105 b, 105 c, 105 d, for example, mounted in twotypical orientations (i.e. parallel or orthogonal to each other) therelay 125 may only use one pickup and transmit antenna but ideallyrequires two antennas mounted orthogonally to each other in order tobetter represent the vehicle antenna orientations.

The present invention further provides data relating to RSSI values whena relay 125, 130 in use with key fob 110. The present invention measuresthe relayed CW signals at the key fob 110 and stores that data. The RSSIresults from the signals determined when there is no relay in use (firstdata set) and when there is a relay in use (second data set) arecompared and analysed to determine a series of conditions that determinewhether or not a relay is in use.

For example, for a particular make and model of vehicle, a number ofmeasurements are made with the key fob 110 in various positions aroundthe vehicle 105. Further measurements are made at the Relay TX 130 whilea relay is in place. This provides two data sets—one where the key fobis operating normally and one where a relay attack is taking place.

In FIG. 3, since there are four vehicle antennas 105 a, 105 b, 105 c and105 d (although it may be appreciated that there may be more than fourantennas), each data set would consist of four RSSI measurement resultsfor each key fob location measured. RSSI measurements from antennas 105a, 105 b, 105 c and 105 d for each position of the key fob 110 are madewithin a PEPS operating region at the vehicle to generate a first dataset. A relay is the inserted between the vehicle and the key fob andRSSI measurements from antennas 105 a, 105 b, 105 c and 105 d for eachposition of the key fob 110 are made at the relay transmitter togenerate a second data set. It will be appreciated that different relayscan be used between the vehicle and the key fob to generate the seconddata set. For example, the second data set may include data obtainedwhen a one dimensional relay was used between the vehicle and the keyfob and also the data obtained when a two dimensional relay was usedbetween the vehicle and the key fob. The first and second data sets canthen be compared. Criteria can be obtained to define the differences inthe two data sets by comparing the data set obtained at the vehicle 105to the data set obtained at the Relay TX 1130. For example, it may beobserved that where the key fob 110 is operating normally (i.e. withouta relay):

-   -   a. When the RSSI of antenna 105 a was greater than 300, the RSSI        level from antenna 105 b was always more than 25 counts greater        than the RSSI from antenna 105 c        To continue with the example, when a relay was in place, the key        fob 110 when located at the Relay TX 130:    -   b. When the antenna 105 a has an RSSI greater than 300, the RSSI        from antenna 105 b is always less than or equal to 25 counts        than antenna 105 c.

Each criteria, which may take the form of a rule or conditionalstatement may be provided in a lookup table or the like or via datastored in a controller associated with the system such that thefollowing criteria is provided for the previous example:

-   -   IF RSSI from antenna 105 a>300 THEN (antenna 105 b RSSI−antenna        105 c RSSI)>25;    -   If the above statement returns TRUE then no relay is present        otherwise if the above statement returns FALSE, a relay is        present.

As will be appreciated this is one example of many and a number ofconditions or statements may be deduced from comparing the data sets. Anumber of conditional statements may be identified and may be utilized.The conditional statements are developed to compensate for RSSItolerances in order to ensure that “false” relay detections are not madewhen the vehicle is in normal operation (i.e. when no relay is present),i.e., eliminating the possibility of false positives.

In operation, the PEPS system 100 defines external operating regions andinternal operating regions using the RSSI signal levels from the variousantennas on the vehicle 105. If an authorized key fob 110 is locatedwithin the correct regions, the RSSI levels correspond and the vehiclewill respond to lock/unlock and start requests. However, the presentinvention adds an additional step, namely determining if criteria aresatisfied and if the request is therefore valid. If the systemdetermines that a relay is in place, then the PEPS entry/start requestis not performed.

It will be appreciated that there may be a situation where a relay canperfectly reproduce the LF challenge signals present at the vehicle 105.However, the relay can only achieve this when the key fob 110 is at aspecific distance from the TX relay 130. If this distance is notmaintained, the “perfect” relay can be exposed utilizing the method andsystem of the present invention. This is because the antenna placementsin a “perfect relay” must be constructed to a physical dimension smallerthan the antenna placements in a typical vehicle size so that thethieves can conceal the relay from the public to avoid raisingsuspicion. Since the relay antenna positions cannot truly represent thereal distances between the antennas in the vehicle, the relay cannotperfectly reproduce the correct LF signal levels for all distancesbetween the key fob and TX relay.

FIG. 4 is a flow diagram illustrating operation of the method 400 of thepresent invention in which it is determined whether or not a relay ispresent in a PEPS system for a vehicle. At step 405, a challenge signalis transmitted from the vehicle to a key fob. The challenge signalincludes LF transmissions from one or more of the vehicle antennas. Itwill be appreciated that any number of suitable antennas may be used(including all of the vehicle antennas—if required). Control then movesto step 410 in which the key fob 110 receives the challenge signal 115and in response to the challenge signal 115 measures the magnetic fieldstrength of the LF CW signals from the vehicle antennas and provides aresponse signal (shown as 120 in FIG. 1). The response signal 120 istypically an RF signal and contains the magnetic field data measured atthe location of the key fob 110 relative to the vehicle 105.

Control then moves to step 415 where it is determined whether or not themeasured magnetic field data meets one or more criteria based on thepredetermined differences in the magnetic field distribution between:

(i). the magnetic field strength values associated with one or moreantennas on the vehicle within the PEPS operating regions and

(ii). the magnetic field strength values associated with the one or moreantennas on the vehicle at the relay transmitter location when a relayis present.

These pre-determined magnetic field strength values when a relay ispresent and when a relay is absent may be stored in a lookup table orthe like associated with a controller in the vehicle 105, oralternatively this can associated with a controller in the keyfob 110.

It can then be determined whether or not the magnetic fields measured bythe key fob 110 meet the criteria (i.e., are the values valid or do theycorrespond to a relay attack).

If it is determined that the magnetic field strength values do not meetthe criteria then the request is rejected and control moves to step 425where the key fob is locked-out for a time period or other appropriateaction is taken. Otherwise if at step 415 it is determined that theresponse signal meets the one or more criteria then control moves tostep 420 where the vehicle may be unlocked or started.

It will be appreciated that the magnetic field strength may be measuredin any suitable way such as an RSSI measurement level which isessentially a quantised abstraction of the magnetic field strength.

It will also be appreciated that the method 400 may loop so for exampleat step 415, criteria may be periodically polled against the key fob 110in the event that the key fob is moving, as previously discussed withreference to FIG. 3, the distance between the key fob and relay TX mustbe at a specific distance; this is harder to achieve for multiplemeasurements and the criteria could be applied more frequently to rejector prevent access to the vehicle.

FIG. 5 is a flow diagram illustrating a method 500 of the presentinvention to obtain data sets for use with the system and method of thepresent invention as described with reference to FIG. 3. The presentinvention utilizes information from two data sets—a first data set(which is magnetic field strength field values) from many positionsmeasured when using a key fob in the PEPS operating regions and a seconddata set (which is magnetic strength field strength values) measured atthe TX Relay 130 when using a relay between the vehicle and key fob.

Step 505, includes transmitting a challenge signal including LF signalsfrom one or more of the antennas associated with a vehicle to a key foband receiving a response signal from the key fob in response to thechallenge signal, wherein the response signal includes the magneticfield strength of the challenge signals at the location of the keyfob—this process is repeated at many positions within the operatingregions and provides a first data set. The data may be stored at acontroller associated with the vehicle, or within the key fob or thelike as described previously.

At step 510, a challenge signal is transmitted including LF signals fromone or more of the antennas associated with a vehicle to a key fob wherea relay is in place and a response signal is received from the key fobin response to the challenge signal, wherein the response signalincludes the magnetic field strength of the challenge signal at thelocation of the key fob at the relay transmitter—this process isrepeated at many positions at the relay transmitter for the vehicleoperating regions and provides a second data set. The data may be storedat a controller associated with the vehicle, or within the key fob orthe like as described previously.

It will be appreciated that different relays can be used between thevehicle and the key fob to generate the second data set. For example,the second data set may include data obtained when a one dimensionalrelay was used between the vehicle and the key fob and also the dataobtained when a two dimensional relay was used between the vehicle andthe key fob.

At step 515, the first and second data sets are analysed and comparedbefore a number of criteria or conditional statements are generated. Theconditional statements will then determine whether or not a relay isbeing used with the PEPS system as described with reference to FIG. 3.

It will be appreciated that the steps of FIG. 5 can be performed with anLF noise source in place instead of a relay. In addition to relay attackdetection, criteria may be used to differentiate between a relay attackand an LF noise source in close proximity to the key fob, for example,an electronic device such as a mobile phone. Advantageously, the presentinvention may then be used to detect an LF noise source as well aspreventing a relay detection from occurring when LF noise is introducedinto the system. Criteria, which may take the form of a rule orconditional statement described above, may be provided in a lookup tableor the like or via data stored in a controller associated with thesystem.

1-14. (canceled)
 15. A method of detecting if a relay is present in aPEPS system for a vehicle, the method comprising: (a) transmitting achallenge signal including an LF telegram and CW signals from one ormore antennas associated with a vehicle to a key fob, the CW signalsbeing measured by the key fob; and (b) determining if the CW signalsmeasured by the key fob meet one or more criteria based on thepredetermined differences in the magnetic field distribution between:(i) the magnetic field strength values associated with one or moreantennas on the vehicle within the PEPS operating regions; and (ii) themagnetic field strength values associated with one or more antennas onthe vehicle at the relay transmitter location when a relay is present.16. A method of detecting if an LF noise source is present in a PEPSsystem for a vehicle, the method comprising: (a) transmitting achallenge signal including an LF telegram and CW signals from one ormore antennas associated with a vehicle to a key fob, the CW signalsbeing measured by the key fob; and (b) determining if the CW signalsmeasured by the key fob meet one or more criteria based on thepredetermined differences in the magnetic field distribution between:(i) the magnetic field strength values associated with one or moreantennas on the vehicle within the PEPS operating regions; and (ii) themagnetic field strength values associated with one or more antennas onthe vehicle within the PEPS operating regions when an LF noise source ispresent.
 17. The method of claim 15, wherein the criteria are developedfor each PEPS operating region individually.
 18. The method of claim 15,wherein the one or more criteria includes one or more conditionalstatements.
 19. The method of claim 15, wherein the magnetic fieldstrength is represented by an RSSI measurement level.
 20. The method ofclaim 15, wherein the challenge signal is transmitted as a low frequencyLF signal.
 21. The method of claim 15, wherein signals other than CWsignals are transmitted by the vehicle antennas for the magnetic fieldstrength measurements.
 22. A system for detecting if a relay is presentin a PEPS system for a vehicle, comprising: one or more antennasassociated with the vehicle for transmitting a challenge signal from theone or more antennas to a key fob; and one or more controllers, each ofwhich is configured to perform the following: (a) transmit the challengesignal including an LF telegram and CW signals from one or more antennasassociated with a vehicle to a key fob, the CW signals being measured bythe key fob; and (b) determine if the CW signals measured by the key fobmeet one or more criteria based on the predetermined differences in themagnetic field distribution between: (i) the magnetic field strengthvalues associated with one or more antennas on the vehicle within thePEPS operating regions; and (ii) the magnetic field strength valuesassociated with one or more antennas on the vehicle at the relaytransmitter location when a relay is present.
 23. A system for detectingif an LF noise source is present in a PEPS system for a vehicle,comprising: one or more antennas associated with the vehicle fortransmitting a challenge signal from the one or more antennas to a keyfob, wherein the CW signals are measured by the key fob; and one or morecontrollers, each of which is configured to perform the following: (a)transmitting the challenge signal including an LF telegram and CWsignals from one or more antennas associated with a vehicle to a keyfob; and (b) determining if the CW signals measured by the key fob meetone or more criteria based on the predetermined differences in themagnetic field distribution between: (i) the magnetic field strengthvalues associated with one or more antennas on the vehicle within thePEPS operating regions; and (ii) the magnetic field strength valuesassociated with one or more antennas on the vehicle within the PEPSoperating regions when an LF noise source is present.
 24. The system ofclaim 22, wherein the controller is located in the vehicle.
 25. Thesystem of claim 22, wherein the controller is located in both thevehicle and the key fob.
 26. A method of obtaining data sets andestablishing criteria for use in detecting if a relay is present in aPEPS system for a vehicle, the method comprising: (a) transmitting achallenge signal including an LF telegram and CW signals from one ormore antennas associated with a vehicle to a key fob within a PEPSoperating region; (b) measuring the magnetic field strength valuesassociated with the challenge signal from a plurality of locationswithin a PEPS operating region and storing the results as a first dataset; (c) inserting a relay between the vehicle and the key fob; (d)transmitting a challenge signal including an LF telegram and CW signalsfrom one or more antennas associated with a vehicle to a key fob at therelay transmitter when a relay is in place; (e) measuring the magneticfield strength values associated with the challenge signal from aplurality of locations at the relay transmitter and storing the resultsas a second data set; (f) comparing the first and second data sets; and(g) generating one or more criteria based on the comparison of the twodata sets.
 27. A method of obtaining data sets and establishing criteriafor use in detecting if an LF noise source is present in a PEPS systemfor a vehicle, the method comprising: (a) transmitting a challengesignal including an LF telegram and CW signals from one or more antennasassociated with a vehicle to a key fob within a PEPS operating region;(b) measuring the magnetic field strength values associated with thechallenge signal from a plurality of locations within a PEPS operatingregion and storing the results as a first data set; (c) inserting an LFnoise source in proximity to the key fob within a PEPS operating region;(d) transmitting a challenge signal including an LF telegram and CWsignals from one or more antennas associated with a vehicle to a key fobwithin a PEPS operating region where an LF noise source is in closeproximity to the key fob; (e) measuring the magnetic field strengthvalues associated with the challenge signal from a plurality oflocations within a PEPS operating region where an LF noise source is inclose proximity to the key fob and storing the results as a second dataset; (f) comparing the first and second data sets; and (g) generatingone or more criteria based on the comparison of the two data sets. 28.The method of claim 26, wherein steps (a) to (g) are repeated for eachPEPS operating region.